@wrongstack/core 0.299.0 → 0.301.0

package/dist/skills/index.js

@@ -40,7 +40,14 @@ function securityScoreToTier(score) {
 }
 
 // src/skills/frontmatter.ts
-var SCALAR_KEYS = /* @__PURE__ */ new Set(["name", "description", "trigger", "version", "license", "compatibility"]);
+var SCALAR_KEYS = /* @__PURE__ */ new Set([
+  "name",
+  "description",
+  "trigger",
+  "version",
+  "license",
+  "compatibility"
+]);
 function parseSkillFrontmatter(raw) {
   const text = normalizeLineEndings(raw);
   if (!text.startsWith("---")) return {};
@@ -99,8 +106,9 @@ function parseFrontmatterBlock(block) {
       out[normalizeKey(key)] = collected.join("\n").trim();
       continue;
     }
-    if (key === "allowed-tools" || key === "allowedTools") {
-      out.allowedTools = rest.split(/[\s,]+/).filter(Boolean);
+    if (key === "allowed-tools" || key === "allowedTools" || key === "required-capabilities" || key === "requiredCapabilities" || key === "required-tools" || key === "requiredTools" || key === "optional-capabilities" || key === "optionalCapabilities") {
+      const values = rest.replace(/^\[/, "").replace(/\]$/, "").split(/[\s,]+/).map(unquote).filter(Boolean);
+      out[normalizeKey(key)] = values;
       i++;
       continue;
     }
@@ -114,7 +122,11 @@ function parseFrontmatterBlock(block) {
   return out;
 }
 function normalizeKey(key) {
-  return key === "allowed-tools" ? "allowedTools" : key;
+  if (key === "allowed-tools") return "allowedTools";
+  if (key === "required-capabilities") return "requiredCapabilities";
+  if (key === "required-tools") return "requiredTools";
+  if (key === "optional-capabilities") return "optionalCapabilities";
+  return key;
 }
 function unquote(s) {
   if (s.length >= 2 && (s.startsWith('"') && s.endsWith('"') || s.startsWith("'") && s.endsWith("'"))) {
@@ -980,7 +992,12 @@ async function openInEditor(filePath, env = process.env) {
   const child = spawn(parts[0], [...parts.slice(1), filePath], {
     stdio: "ignore",
     detached: true,
-    shell
+    shell,
+    // `shell` routes through cmd.exe on win32, which flashes a console window
+    // before the editor appears. A GUI editor is unaffected by the flag; the
+    // shell wrapper is what it suppresses. Repo convention — see
+    // `core/tests/architecture/spawn-convention.test.ts`.
+    windowsHide: true
   });
   child.unref();
 }

package/dist/storage/cloud-config-sync/sanitize.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Contract-aware partitioning and sanitization for my.wrongstack.com config sync.
+ *
+ * The portal's namespace registry owns a fixed set of `config.json` top-level keys and
+ * validates each payload against a strict, recursively-specified schema (server repo:
+ * `docs/CLIENT_SYNC_CONTRACT.md`). This module is the client half of that contract:
+ *
+ * - `buildNamespacePayloads` projects the local config onto the contract field tree, so a
+ *   payload can never carry a field the server does not know (which would 422) — and, more
+ *   importantly, can never carry credential material: secret-bearing paths simply are not
+ *   in the tree.
+ * - `applyNamespacePayload` merges a pulled server payload back at contract-field
+ *   granularity, so locally-kept fields the contract does not own (e.g. `tools.exec`,
+ *   `mcpServers.*.env`, every `providers.*.apiKey`) are never clobbered by a pull.
+ *
+ * Stripping is therefore structural (projection), with `stripSecretMaterial` as a final
+ * defense-in-depth pass mirroring the server's own scan.
+ */
+/** `true` = the whole value is contract-owned; an object = recurse per key; `'*'` = record wildcard. */
+export type ContractNode = true | {
+    [key: string]: ContractNode;
+};
+/** Namespace → the contract tree over the `config.json` top-level keys it owns. */
+export declare const CLOUD_SYNC_CONTRACT: Readonly<Record<string, ContractNode>>;
+export declare const CLOUD_SYNC_NAMESPACES: string[];
+/** Server-side schema versions, sent in every push envelope. */
+export declare const NAMESPACE_SCHEMA_VERSIONS: Readonly<Record<string, number>>;
+/**
+ * Top-level keys that must never leave the machine, per the contract. Everything not in a
+ * contract tree stays local implicitly; this list exists for documentation and tests.
+ */
+export declare const LOCAL_ONLY_TOP_LEVEL: readonly ['version', 'configScope', 'hq', 'cloudSync', 'sync', 'models', 'apiKey', 'baseUrl'];
+/**
+ * Defense-in-depth sweep run over every outgoing payload after projection: drops any
+ * secret-named key and any string value that is (or contains) an encrypted blob. Returns
+ * `undefined` when nothing survives.
+ */
+export declare function stripSecretMaterial(value: unknown): unknown;
+/**
+ * Builds the per-namespace payloads to push. Sections absent locally are omitted (every
+ * top-level contract key is optional server-side); a namespace with nothing to say is
+ * omitted entirely.
+ */
+export declare function buildNamespacePayloads(config: Record<string, unknown>): Record<string, Record<string, unknown>>;
+/**
+ * Applies a pulled namespace snapshot to the local config object, returning a new object.
+ *
+ * Only keys present in the payload are touched (an omitted optional section means "the
+ * server doesn't know", never "deleted"), and inside each section only contract-owned
+ * paths are replaced — `providers.*.apiKey`, `mcpServers.*.env`, `tools.exec`, and any
+ * field newer than the contract stay exactly as they are locally.
+ */
+export declare function applyNamespacePayload(config: Record<string, unknown>, namespace: string, payload: Record<string, unknown>): Record<string, unknown>;
+//# sourceMappingURL=sanitize.d.ts.map

package/dist/storage/cloud-config-sync.d.ts

@@ -0,0 +1,87 @@
+export { applyNamespacePayload, buildNamespacePayloads, CLOUD_SYNC_CONTRACT, CLOUD_SYNC_NAMESPACES, LOCAL_ONLY_TOP_LEVEL, NAMESPACE_SCHEMA_VERSIONS, stripSecretMaterial, } from './cloud-config-sync/sanitize.js';
+/**
+ * CloudConfigSync — synchronizes the profile config with my.wrongstack.com over the
+ * namespaced sync API v1 (server repo: docs/CLIENT_SYNC_CONTRACT.md).
+ *
+ * Distinct from the legacy GitHub `CloudSync` (whole-file categories to a private repo)
+ * and from the local HQ command center: this speaks the portal's revisioned,
+ * schema-validated, secret-free namespace protocol.
+ *
+ * A sync pass is pull-then-push:
+ *   1. `GET /config?since=<cursor>` — apply changed namespaces at contract granularity
+ *      (locally-kept fields the contract does not own are never clobbered).
+ *   2. For each namespace whose projected payload hash differs from the last synced
+ *      hash: `PUT /config/<ns>` with `baseRevision` + a persisted `mutationId`, so a
+ *      crash-and-retry of the same logical change is idempotent server-side.
+ *   3. `POST /heartbeat` with the cursor and revision map for fleet observability.
+ *
+ * Conflicts (409) resolve by three-way merge at owned-top-level-key granularity: keys the
+ * local machine did not change since its last sync adopt the server value; keys it did
+ * change keep the local value and are re-pushed on top of the server revision.
+ */
+export interface CloudConfigSyncSettings {
+    enabled: boolean;
+    /** Portal base URL, e.g. https://my.wrongstack.com — no trailing slash needed. */
+    url: string;
+    /** Machine bearer token (wst_…), already decrypted. */
+    token: string;
+}
+export interface CloudConfigSyncDeps {
+    /** State file location, e.g. `<profileDir>/cloud-sync-state.json`. */
+    statePath: string;
+    /** Reads the decrypted profile config object (the file layer, not env/CLI merges). */
+    readLocalConfig(): Promise<Record<string, unknown>>;
+    /**
+     * Atomically mutates the profile config file. The mutator receives the decrypted
+     * object and returns the replacement; the writer re-encrypts secrets and persists.
+     */
+    writeLocalConfig(mutator: (config: Record<string, unknown>) => Record<string, unknown>): Promise<void>;
+    /** Resolved cloud-sync settings, or null when unconfigured/disabled. */
+    getSettings(): CloudConfigSyncSettings | null;
+    fetchImpl?: typeof fetch | undefined;
+    appVersion?: string | undefined;
+    logger?: {
+        info(msg: string): void;
+        warn(msg: string): void;
+    } | undefined;
+    randomUUID?: (() => string) | undefined;
+    /** Request timeout per HTTP call. Default 15s. */
+    requestTimeoutMs?: number | undefined;
+}
+export interface CloudSyncPassSummary {
+    ok: boolean;
+    skipped: boolean;
+    pulled: string[];
+    pushed: string[];
+    conflicted: string[];
+    rejected: string[];
+    message: string;
+}
+export declare class CloudConfigSync {
+    private readonly deps;
+    private state;
+    private readonly fetchImpl;
+    private readonly uuid;
+    private readonly timeoutMs;
+    constructor(deps: CloudConfigSyncDeps);
+    /** One full pull-then-push-then-heartbeat pass. Never throws; failures are summarized. */
+    syncOnce(): Promise<CloudSyncPassSummary>;
+    /** Human-readable status for the slash command. */
+    statusText(): Promise<string>;
+    private pullChanges;
+    private applySnapshot;
+    private dirtyNamespaces;
+    private pushDirty;
+    private putNamespace;
+    /**
+     * Three-way merge at owned-top-level-key granularity: keys unchanged locally since the
+     * last sync adopt the server value; locally-changed keys win and are re-pushed on top
+     * of the server revision with a fresh mutation id.
+     */
+    private resolveConflict;
+    private heartbeat;
+    private request;
+    private loadState;
+    private saveState;
+}
+//# sourceMappingURL=cloud-config-sync.d.ts.map

package/dist/storage/director-state.d.ts

@@ -127,6 +127,13 @@ export declare class DirectorStateCheckpoint {
      * checkpoint continues from there.
      */
     resume(snapshot: DirectorStateSnapshot): void;
+    /**
+     * After resume, pin the live spawn ceiling from the current profile/flag
+     * while preserving `spawnCount` (cumulative used budget). Checkpoint
+     * metadata previously stored a historical `maxSpawns` that can diverge
+     * from the live runtime ceiling — operators need the live value to win.
+     */
+    applyLiveMaxSpawns(maxSpawns: number | undefined): void;
     current(): DirectorStateSnapshot;
     recordSpawn(sub: DirectorSubagentState, spawnCount: number): void;
     recordTaskAssigned(task: DirectorTaskState): void;

package/dist/storage/index.d.ts

@@ -38,6 +38,7 @@ export { DefaultPromptStore, migratePromptEntry, promptChecksum, type PromptStor
 export { PromptUsageStore, type PromptUsage } from './prompt-usage-store.js';
 export { InputHistoryStore, INPUT_HISTORY_DEFAULT_MAX, } from './input-history-store.js';
 export { CloudSync, type SyncResult, ALL_SYNC_CATEGORIES, } from './cloud-sync.js';
+export { applyNamespacePayload, buildNamespacePayloads, CLOUD_SYNC_CONTRACT, CLOUD_SYNC_NAMESPACES, CloudConfigSync, type CloudConfigSyncDeps, type CloudConfigSyncSettings, type CloudSyncPassSummary, LOCAL_ONLY_TOP_LEVEL, NAMESPACE_SCHEMA_VERSIONS, stripSecretMaterial, } from './cloud-config-sync.js';
 export { createSessionEventBridge, resolveAuditLevel, resolveSessionLoggingConfig, type SessionEventBridge, type AuditLevel, type SessionEventBridgeOptions, type SessionSamplingOptions, type ToolProgressSamplingOptions, CORE_RECONSTRUCT_EVENTS, STANDARD_AUDIT_EVENTS, } from './session-event-bridge.js';
 export type { SyncConfig, SyncCategory } from '../types/config.js';
 //# sourceMappingURL=index.d.ts.map